1

The contact form on a site I am currently developing was displaying an error when trying to submit and says the form has expired.

Based on feedback I found in various forums, the workaround I have found was to turn off CSRF protection through the config file using this code:

$config['disable_csrf_protection'] = 'y'; 

This fixes the form, but creates another bug that prevents users from being able to log out, causing this error: You are not authorized to perform this action.

Does anyone have a solution that will fix both problems?

  • You just should disable the csrf protection in very specific situations, like a server based cache. These forms being rejected are on CP or on front end? – Robson Sobral Oct 25 '14 at 14:16
  • The form that is giving me the error is a contact form on the front end. I remember setting a CSRF setting in the database in the past, but I cannot find where this was. – Amanda Oct 25 '14 at 22:53
  • Is the date and time of the server set right? Does the {current_time} give you the right time? – Robson Sobral Oct 25 '14 at 23:25
  • The data is correct, and the time is showing up as Eastern time zone (I am in Mountain time zone.) – Amanda Oct 26 '14 at 14:39
0

I found an answer that seems to be working. Here are the details in case anyone else is having a similar issue.

I kept the code in the config.php file that turns off CSRF protection:

$config['disable_csrf_protection'] = 'y'; 

Then to fix the issue with logout failing, I implemented an edit suggested by Robin Sowell on the Ellis Lab forum. The edit is in the file "system/expressionengine/modules/member/mod.member_auth.php":

Find this code in that file:

if ($token != CSRF_TOKEN)
{

and change to:

if ( ! bool_config_item('disable_csrf_protection') && $token != CSRF_TOKEN)
{
| improve this answer | |
  • Just circling back for any new readers- the inability to logout with csrf disabled was indeed a bug fixed in 2.8.2. But Robson's right- csrf should only be disabled for testing and shouldn't be a long term solution to a secure form problem. – Robin Sowell May 27 '15 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.